{
  "name": "Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS",
  "slug": "blog-anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics",
  "description": "Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept. 2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.",
  "published": "2025-10-10T14:56:05+00:00",
  "created_at": "2025-10-10T14:56:05+00:00",
  "modified_at": "2025-10-10T15:05:32+00:00",
  "created_at_opencti": "2025-10-10T14:56:05+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-10-10",
    "defacement",
    "exploit",
    "hacktivist",
    "human-machine interface",
    "megamedusa",
    "modbus",
    "overflame",
    "raas",
    "ransomware",
    "russian",
    "twonet"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "87.150.146.207"
      },
      {
        "id": "",
        "name": "80.210.133.38"
      },
      {
        "id": "",
        "name": "77.91.122.234"
      },
      {
        "id": "",
        "name": "5.106.148.199"
      },
      {
        "id": "",
        "name": "45.157.234.199"
      },
      {
        "id": "",
        "name": "2.181.103.232"
      },
      {
        "id": "",
        "name": "95.90.199.75"
      },
      {
        "id": "",
        "name": "45.14.247.87"
      },
      {
        "id": "",
        "name": "92.43.161.74"
      },
      {
        "id": "",
        "name": "212.83.190.55"
      }
    ],
    "malware": [
      {
        "id": "6fc13c03-00f6-4737-951b-6c6d878cfa06",
        "name": "megaMedusa",
        "slug": "megamedusa"
      }
    ],
    "intrusion_sets": [
      {
        "id": "b85d39d8-612f-4939-baa6-b95098994944",
        "name": "TwoNet",
        "slug": "twonet"
      }
    ],
    "attack_patterns": [
      {
        "id": "9c5a540b-0649-4ac2-a0e5-ef501853cd6a",
        "name": "T1031"
      },
      {
        "id": "6e83fab1-fad9-48b8-aa01-9949f27130f1",
        "name": "T1016.001"
      },
      {
        "id": "f4ff51d0-fee1-48f6-aaf1-03dccee28091",
        "name": "T1464"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "820fbdf8-7db2-4292-9a60-7eed3567be8d",
        "name": "T1210"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Energy"
      }
    ]
  },
  "external_refs": [
    "https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/",
    "https://otx.alienvault.com/pulse/68e93aa69b891f05e0cc0c7a"
  ]
}